CVE-2026-40468
Heap buffer overflow in gawk
CVE-2026-40468 is fixed in 2 products on 1 platform, first by RHSA-2026:73429, released July 13, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
4.4
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0020
10th percentile
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| gawk · RHEL 10 | 5.3.0-6.el10_2.1 | RHSA-2026:73429 | Jul 13, 2026 |
| gawk · RHEL 8 | 0:4.2.1-5.el8_10 | RHSA-2026:73511 | Oct 2, 2026 |
| gawk · RHEL 9 | 0:5.1.0-6.el9_8.1 | RHSA-2026:73512 | Sep 30, 2026 |
| gawk · Ubuntu 18.04.6 LTS (bionic) | 1:4.1.4+dfsg-1ubuntu0.1~esm2 | gawk 1:4.1.4+dfsg-1ubuntu0.1~esm2 | Jul 24, 2026 |
| gawk · Ubuntu 20.04 LTS (focal) | 1:5.0.1+dfsg-1ubuntu0.1+esm1 | gawk 1:5.0.1+dfsg-1ubuntu0.1+esm1 | Jul 24, 2026 |
| gawk · Ubuntu 22.04.1 LTS (jammy) | 1:5.1.0-1ubuntu0.2 | gawk 1:5.1.0-1ubuntu0.2 | Jul 24, 2026 |
| gawk · Ubuntu 24.04.5 LTS (noble) | 1:5.2.1-2ubuntu0.1 | gawk 1:5.2.1-2ubuntu0.1 | Jul 24, 2026 |
| gawk-all-langpacks · RHEL 9 | 0:5.1.0-6.el9_8.1 | RHSA-2026:73512 | Sep 30, 2026 |